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This listing of claims replaces all prior versions, and 
listings of claims in the instant application: 

Listing of Claims : 

1. (Previously Presented) An anti-malware file scanning 
system for computer files being transferred between computers, 
the system being implemented on a computer apparatus and 
comprising: 

a) a computer database containing records of known 
executable programs which are deemed to be not malware and 
criteria by which a file being processed can be determined to 
be an instance of one of those programs, the criteria including 
at least one characteristic signature associated with each said 
instance; 

b) means for processing a file being transferred between 
computers, the means b) comprising: 

a file recogniser operative to determine whether the 
file being processed is an instance of a known program by 
checking the contents of the file being processed for the 
presence of said at least one characteristic signature 
associated with the said instances; and 

a difference checker operative, in the case that the 
file recogniser determines the file being processed to be 
an instance of a known program, to check whether the file 
is an unchanged version of that known program; and 

c) means for signalling the file, depending on the 
determination made by the processing means, as being: 

likely to be not malware if it is an unchanged 
version of a known file; 

likely to be malware if it is a changed version of a 
known file; or 

of unknown status if it is not determined as being an 
instance of a known file. 



Page 2 of 15 



Appl. No. 10/500,954 

Amdt. dated September 4, 2009 

Reply to Office Action of June 4, 2009 



2. (Previously Presented) A system according to claim 1 
and including: 

d) means for processing a file being transferred between 
computers to determine whether it is considered to be, or 
considered possibly to be, malware, and wherein the means d) is 
operative to subject a file to processing if the file is 
signaled by the signalling means c) as being of unknown status. 



3-4. (Canceled) 



5. (Previously Presented) A system according to claim 1 
wherein the difference checker is operative to generate a 
checksum for the entire file under consideration or for at 
least one selected region thereof, and to compare the checksum 
or checksums with those of entries in the database. 

6. (Previously Presented) A system according to claim 1 
and including an exception list handler operative to determine, 
in relation to a file which the processing means b) has 
determined is a changed version of a known file, whether that 
file has characteristics matching an entry in an exception list 
of files, the signalling means c) being operative to signal the 
file as malware only if it is not in the exception list or as 
being of unknown status otherwise. 

7. (Previously Presented) A method of anti-malware 
scanning computer files being transferred between computers, 
the method comprising: 

maintaining a computer database containing records of 
known executable programs which are deemed to be uninfected and 
criteria by which a file being processed can be determined to 
be an instance of one of those programs, the criteria including 
at least one characteristic signature associated with each said 
instance; 
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processing a file being transferred between computers by 
determining whether the file being processed is an 
instance of a known program by checking the contents of the 
file being processed for the presence of said at least one 
characteristic signature associated with the said instances, 
and 

checking, in the case that the file is determined to be an 
instance of a known program, whether the file is an unchanged 
version of that known program; 

signalling the file, depending on the determination made 
by the processing, as being: 

likely to be not malware if it is an unchanged 
version of a known file; 

likely to be malware if it is a changed version of a 
known file; or 

of unknown status if it is not determined as being an 
instance of a known file; and 

storing the determination that the file is likely to be 
not malware, is likely to be malware or is of unknown status. 

8. (Previously Presented) A method according to claim 7 
and including: 

processing a file being transferred between computers to 
determine whether it is considered to be, or considered 
possibly to be, malware, if the file is signalled by the 
signalling step c) as being of unknown status. 

9-10. (Canceled) 

11. (Previously Presented) A method according to claim 7 
wherein the step of checking whether the file being processed 
is an instance of a known program comprises generating a 
checksum for the entire file under consideration or for at 
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least one selected region thereof, and comparing the checksum 
or checksums with those of entries in the database. 

12. (Previously Presented) A method according to claim 7 
further including using an exception list to determine, in 
relation to a file which the processing step b) has determined 
is a changed version of a known file, whether that file has 
characteristics matching an entry in an exception list of 
files, and wherein, in the signalling step c) , the file is 
signalled as malware if it is not in the exception list or as 
being of unknown status otherwise. 

13. (Previously Presented) An anti-malware file scanning 
system for computer files being transferred between computers, 
the system comprising: 

a computer database containing records of known executable 
programs which are deemed to be not malware and criteria by 
which a file being processed can be determined to be an 
instance of one of those programs, the criteria including at 
least one characteristic signature associated with each said 
instance; 

a processor for processing a file being transferred 
between computers, the processor being operative to determine 
whether the file being processed is an instance of a known 
program by checking the contents of the file being processed 
for the presence of said att least one characteristic signature 
associated with the said instances and, in the case that the 
file being processed is determined to be an instance of a known 
program, to check whether the file is an unchanged version of 
that known program, 

said processor, depending on the determination, 
identifying the file being processed as (i) likely to be not 
malware if it is an unchanged version of a known file; (ii) 
likely to be malware if it is a changed version of a known 
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file; or (iii) of unknown status if it is not determined as 
being an instance of a known file. 

14. (Previously Presented) An anti-malware file scanning 
system according to claim 13, further comprising: 

a file-scanning subsystem for scanning files identified by 
the processor as being of unknown status to determine whether 
the scanned files are malware. 

15. (Previously Presented) An anti-malware file scanning 
system according to claim 14, wherein records for files which 
are instances of programs determined by the file-scanning 
system not to be malware are added to the computer database. 

16. (Previously Presented) An anti-malware file scanning 
system according to claim 13, wherein the processor assigns a 
score to a file identified as likely to be malware. 



Fn(S3l) 659-0888 
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